±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 34714
New Yesterday: 2 Visitors: 216

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Triage and/or Preview Procedures

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2  Next 
  

Triage and/or Preview Procedures

Post Posted: Fri May 21, 2010 7:00 am

I have been tasked by the powers above to find a way of 'trimming' or 'filtering' our backlog. It seems like it will be an ominous and arduous task, but i wondered if anyone else incorporates a Triage or Preview process which will lead to items being filtered out that do not warrant an investigation? I know Triage and Preview are different, but how different? I have already been in contact with Harry Parsonage at Nottinghamshire about there Triage process. Is there a procedure or policy for a previewing stage that any LE agency uses?

Many thanks in advance  

SteveS
Member
 
 
  

Re: Triage and/or Preview Procedures

Post Posted: Fri May 21, 2010 8:14 am

Hi Steve,

Have you considered purchasing some new equipment to help you do this? Evidence Talks' SPEKTOR is a Forensic Triage Solution which takes the strain out of Forensic Triage. Have a look at www.evidencetalks.com or give us a call at 08451254400 for more info.

Cheers

David



- SteveS
I have been tasked by the powers above to find a way of 'trimming' or 'filtering' our backlog. It seems like it will be an ominous and arduous task, but i wondered if anyone else incorporates a Triage or Preview process which will lead to items being filtered out that do not warrant an investigation? I know Triage and Preview are different, but how different? I have already been in contact with Harry Parsonage at Nottinghamshire about there Triage process. Is there a procedure or policy for a previewing stage that any LE agency uses?

Many thanks in advance
 

CFUNN
Member
 
 
  

Re: Triage and/or Preview Procedures

Post Posted: Fri May 21, 2010 8:39 am

Steve

We have done a similar process in South Wales Police HTCU.
If you ring me I'll discuss it with you. We have both Policies and Procedures for Triage.

Without being controversial on an open forum, the answer does not lay in the tools. Our force was a contributor to a workstream testing 'tools'. They are not all what they are cracked up to be.
_________________
Paul Webb 

Webbie
Member
 
 
  

Re: Triage and/or Preview Procedures

Post Posted: Fri May 21, 2010 11:53 pm

Steve,

Triage is absolutely one of the things that all forensic agencies are having to do, some better than others. With respect to your question of "Is there a procedure or policy for a previewing stage that any LE agency uses?" Triage must be viewed as an initial assessment. The slippery slope is that judges may try to say that if nothing is found during the triage phase, then no further work can be done on that system. Some people, who must be trying to be a lawyer, have said that you negate or diminish your probable cause if you triage and dont find anything. this is simply not true. If you would like to see what I think is one of the best executed triage programs look like, check out drive prophet (driveprophet.com). What makes this so good is that there are 3-4 things that make a successful triage tool. 1-speed, 2-user friendly interface, 3-targetingthe correct data points and 4- and this one is the one that everyone fails at - presenting an easily digestible output that non-technical people can quickly understand. Most tools provide too much technical details because they can not really think like a non-techie.

What info do you need to make a quick assessment of what was going on with a computer. Well, it really depends on the type of case/investigation it is but in general you would probably want the following.

A unique list of top level domains visited on the internet via the web browser(s). Identifying number of times visited is also nice so assess what sites were visited the most.

Internet search history. What words have been searched for via the most popular search engines e.g. Google, Bing, Yahoo, etc. and what date/time and user did the search.

What files were recently opened by the user (found through both lnk files in the recent directory and from the recentdocs registry key.

what applications have been recently executed by the user (c:windows/prefetch and UserAssist registry key)

USB Storage devices plugged into the system (UsbStor registry key)

Then you may also want to look at the graphics on the system or if Vista or Windows7 take a look at the thumbscache32, 96, 256, and 1024.

There is a lot more you can look at but this is one of the best starts you could build from.

If you can download a demo of driveprophet and run it against a write blocked drive or a mounted image you will see a lot more information but all presented in a very "agent friendly" hyperlinked report.

Good luck.  

cyberspeak
Newbie
 
 
  

Re: Triage and/or Preview Procedures

Post Posted: Sat May 22, 2010 3:37 am

There are two previous discussions of triage and previewing on FF that you may also get some information on.

The topics are:
triage tools
Previewing or Imaging

I'd say that since this topic keeps coming up and commercial tools are being sold for triage/previewing, it must be a very relevant topic. Triage can be done with a single purchased tool such as the one mentioned in this thread (Driveprophet), or created with tools you already have on hand.  

bshavers
Senior Member
 
 
  

Re: Triage and/or Preview Procedures

Post Posted: Sat May 22, 2010 11:12 am

What makes this an arduous task? Volume, or not knowing/understanding what you're looking for?  

keydet89
Senior Member
 
 
  

Re: Triage and/or Preview Procedures

Post Posted: Sat May 22, 2010 12:49 pm

Hi Steve, Just a thought but if you would like a demo of SPEKTOR let me know- we are based in Milton Keynes so wouldn't take long for us to come to you or you to come to our secure facility

David  

CFUNN
Member
 
 

Page 1 of 2
Go to page 1, 2  Next